Fix it and prove it: a security workflow for vibe coders
Scan, fix with AI prompts, re-scan, and only then ship — so the AI does not quietly undo your hardening.
The failure mode we see most: you ask the AI to lock something down, it says done, and three prompts later it reintroduces the bug while building a feature.
- Scan the live URL (passive checks for keys, .env, .git, headers).
- Fix with a specific prompt — one issue at a time.
- Prove with a re-scan before you tweet the launch link.
- Pin a rule in Lovable Knowledge /
.cursorrules/ Bolt project prompt so secrets and RLS stay locked.
Copy-paste into your AI builder
Add a standing project rule: Never put secret API keys in frontend code. All paid API calls go through a server function. Every database table must have RLS enabled with auth.uid() policies. Do not remove these rules.
Related: Hide API keys · Is my Lovable app secure?
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down.